# Pre-commit hooks for security and quality checks
# Install: pre-commit install
# Run manually: pre-commit run --all-files
repos:
# Basic code quality checks
- repo: https://github.com/pre-commit/pre-commit-hooks
rev: v4.5.0
hooks:
- id: trailing-whitespace
- id: end-of-file-fixer
- id: check-yaml
- id: check-added-large-files
args: ['--maxkb=1000']
- id: check-json
- id: check-toml
- id: check-merge-conflict
- id: detect-private-key
- id: check-ast
- id: check-builtin-literals
- id: check-case-conflict
- id: check-docstring-first
- id: debug-statements
- id: mixed-line-ending
# Python formatting with Black
- repo: https://github.com/psf/black
rev: 23.12.1
hooks:
- id: black
language_version: python3.10
args: ['--line-length=100']
# Python linting with Ruff
- repo: https://github.com/astral-sh/ruff-pre-commit
rev: v0.8.6
hooks:
- id: ruff
args: ['--fix', '--exit-non-zero-on-fix']
# Security scanning with Bandit
- repo: https://github.com/PyCQA/bandit
rev: 1.7.6
hooks:
- id: bandit
args: ['-c', '.bandit', '-r', 'src/']
pass_filenames: false
# Secret detection with detect-secrets
- repo: https://github.com/Yelp/detect-secrets
rev: v1.4.0
hooks:
- id: detect-secrets
args: ['--baseline', '.secrets.baseline']
exclude: package.lock.json
# Gitleaks secret scanning
- repo: https://github.com/gitleaks/gitleaks
rev: v8.18.1
hooks:
- id: gitleaks
# Type checking with mypy
- repo: https://github.com/pre-commit/mirrors-mypy
rev: v1.8.0
hooks:
- id: mypy
args: ['--config-file=pyproject.toml']
additional_dependencies:
- 'types-requests'
- 'types-python-dotenv'
# Markdown linting
- repo: https://github.com/markdownlint/markdownlint
rev: v0.12.0
hooks:
- id: markdownlint
args: ['--config', '.markdownlint.json']
# YAML linting
- repo: https://github.com/adrienverge/yamllint
rev: v1.33.0
hooks:
- id: yamllint
args: ['-c', '.yamllint.yml']
# Configuration
default_language_version:
python: python3.10
# Don't fail on warnings
fail_fast: false
# Minimum pre-commit version
minimum_pre_commit_version: '2.20.0'